Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 956332" data-attributes="member: 32260">This will not work as well as you think. If you click on a hyperlink in the PDF document, then PDF viewer does not use the Intenet but simply the call is redirected to your default web browser. This cannot be also blocked by blocking child processes for the PDF viewer. Blocking Internet access to the PDF viewer can help when the viewer is exploited and the malicious code runs in the memory of this viewer to download the payload from the Internet. But, this will not help if the payload is embedded in the PDF document.Another thing is that we really do not know how many Adobe Reader&#039;s vulnerabilities are present in other PDF readers. All these applications deal with the same PDF documents so some vulnerabilities may be shared. We only suspect that the differences between Adobe Reader and other PDF viewers can efficiently reduce the number of shared vulnerabilities, but there is no information on how efficient this can be.One can argue that it would be hard to find people who use Foxit Reader and were infected via PDFs, but this can follow as well from the fact that many more people use Adobe Reader.</blockquote>

[QUOTE="Andy Ful, post: 956332, member: 32260"] This will not work as well as you think. If you click on a hyperlink in the PDF document, then PDF viewer does not use the Intenet but simply the call is redirected to your default web browser. This cannot be also blocked by blocking child processes for the PDF viewer. Blocking Internet access to the PDF viewer can help when the viewer is exploited and the malicious code runs in the memory of this viewer to download the payload from the Internet. But, this will not help if the payload is embedded in the PDF document. Another thing is that we really do not know how many Adobe Reader's vulnerabilities are present in other PDF readers. All these applications deal with the same PDF documents so some vulnerabilities may be shared. We only suspect that the differences between Adobe Reader and other PDF viewers can efficiently reduce the number of shared vulnerabilities, but there is no information on how efficient this can be. One can argue that it would be hard to find people who use Foxit Reader and were infected via PDFs, but this can follow as well from the fact that many more people use Adobe Reader. [/QUOTE]

Verification